Deserialization in Apache Bookkeeper
CVE-2019-17571
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
Vulnerability class: Insecure Deserialization
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.700 (99.4th percentile), scored .
High probability of exploitation in the next 30 days — patch promptly. 99th percentile — 99.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.691 · newest: 0.700 · change: +0.009
Affected products
- Apache Bookkeeper
- Apache Log4j
- Apache Software Foundation Log4j — versions versions up to 1.2.17
- NetApp Oncommand System Manager
- NetApp Oncommand Workflow Automation
- Oracle Application Testing Suite — versions 13.3.0.1
- Oracle Communications Network Integrity
- Oracle Endeca Information Discovery Studio — versions 3.2.0
- Oracle Financial Services Lending And Leasing — versions 12.5.0
- Oracle MySQL Enterprise Monitor
Weakness classification (CWE)
Public proof-of-concept exploits
References
- lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c099… (mailing-list)
- lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e… (mailing-list)
- lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d… (mailing-list)
- lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef… (mailing-list)
- lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a9… (mailing-list)
- lists.apache.org/thread.html/564f03b4e9511fcba29c68fc0299372dadbdb002718fa8edcc… (mailing-list)
- lists.apache.org/thread.html/r2756fd570b6709d55a61831ca028405bcb3e312175a60bc5d… (mailing-list)
- lists.apache.org/thread.html/752ec92cd1e334a639e79bfbd689a4ec2c6579ec5bb41b53ff… (mailing-list)
- lists.apache.org/thread.html/r189aaeaad897f7d6b96f7c43a8ef2dfb9f6e9f8c1cc9ad182… (mailing-list)
- lists.apache.org/thread.html/r3c575cabc7386e646fb12cb82b0b38ae5a6ade8a800f82710… (mailing-list)
Frequently asked questions
- What is CVE-2019-17571?
- CVE-2019-17571 is a critical-severity vulnerability in Apache Bookkeeper, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2019-12-20.
- How severe is CVE-2019-17571?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2019-17571 known to be exploited?
- 81 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.